Session Doesn't expire after 2fa and also other session can change passsword
Low
S
SideFX
Submitted None
Actions:
Reported by
0xchoudhary
Vulnerability Details
Technical details and impact analysis
## Summary:
Hi team,
I found one issue related to your 2FA system on https://sidefx.com
## Steps To Reproduce:
Login to the Same account in 2 different browser
Now on 1st browser go to https://sidefx.com/profile and complete the all steps of 2fa and Enable it | 2FA activated
Now go to another session or 2nd browser and reload the page.
The account doesn't logout session is still alive.
and now change the password on 2nd browser (which doesn't have 2fa enabled)
BOOM!
## Impact
In this scenario when 2FA is activated the other sessions of the account are not invalidated.
2FA is required to login. I believe the expected and recommended behavior here is to terminate the other sessions> request a new login> request the 2FA code> so then give the account access again
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Improper Access Control - Generic